@lowdefy/server 6.0.0 → 6.1.0

package/src/middleware/apiContext.test.mjs

@@ -0,0 +1,118 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+import { Hono } from 'hono';
+import { jest } from '@jest/globals';
+
+const secret = 'planted-apicontext-secret';
+process.env.LOWDEFY_SECRET_TEST = secret;
+
+jest.unstable_mockModule('@lowdefy/api', () => ({ createApiContext: jest.fn() }));
+jest.unstable_mockModule('../../lib/build/appMeta.js', () => ({ default: {} }));
+jest.unstable_mockModule('../../lib/build/config.js', () => ({ default: {} }));
+jest.unstable_mockModule('../../lib/build/i18n.js', () => ({ default: {} }));
+jest.unstable_mockModule('../../lib/build/logger.js', () => ({ default: { sentry: {} } }));
+jest.unstable_mockModule('../../lib/server/log/createHandleError.js', () => ({
+  default: jest.fn(() => jest.fn()),
+}));
+jest.unstable_mockModule('../../lib/server/log/createLogger.js', () => ({
+  default: jest.fn(() => ({ debug: jest.fn(), info: jest.fn(), warn: jest.fn(), error: jest.fn() })),
+}));
+jest.unstable_mockModule('../../lib/server/fileCache.js', () => ({ default: {} }));
+jest.unstable_mockModule('../../lib/server/auth/session.js', () => ({
+  default: jest.fn(async () => undefined),
+}));
+jest.unstable_mockModule('../../lib/server/auth/strategies.js', () => ({
+  default: jest.fn(async () => null),
+}));
+jest.unstable_mockModule('../../lib/server/log/logRequest.js', () => ({ default: jest.fn() }));
+jest.unstable_mockModule('../../lib/server/sentry/setSentryUser.js', () => ({
+  default: jest.fn(),
+}));
+
+// apiContext statically imports the app build's plugin artifacts, which only
+// exist in a built app (build/** is gitignored). Materialize the minimal set
+// it needs so the import resolves; clean up only what this test created.
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+const pluginsDir = path.resolve(dirname, '../../build/plugins');
+const fixtures = [
+  { file: 'agents.js', content: 'export default {};\n' },
+  { file: 'connections.js', content: 'export default {};\n' },
+  {
+    file: 'notifications.js',
+    content:
+      'export default {};\nexport const interpolateProperties = () => {};\nexport const renderEmail = () => {};\n',
+  },
+  { file: path.join('operators', 'server.js'), content: 'export default {};\n' },
+  { file: path.join('operators', 'serverJsMap.js'), content: 'export default {};\n' },
+  { file: 'websockets.js', content: 'export default {};\n' },
+].map(({ file, content }) => ({ absolutePath: path.join(pluginsDir, file), content }));
+
+const createdFixtures = [];
+fixtures.forEach(({ absolutePath, content }) => {
+  if (!fs.existsSync(absolutePath)) {
+    fs.mkdirSync(path.dirname(absolutePath), { recursive: true });
+    fs.writeFileSync(absolutePath, content);
+    createdFixtures.push(absolutePath);
+  }
+});
+
+// A checkout that has built an app already holds real artifacts here, which import plugins this
+// package does not depend on, so the stubs are also mocked over whatever is on disk.
+fixtures.forEach(({ absolutePath }) => {
+  jest.unstable_mockModule(absolutePath, () => ({
+    default: {},
+    interpolateProperties: () => {},
+    renderEmail: () => {},
+  }));
+});
+
+afterAll(() => {
+  createdFixtures.forEach((absolutePath) => fs.rmSync(absolutePath, { force: true }));
+});
+
+const { default: apiContext } = await import('./apiContext.js');
+
+function createApp() {
+  const app = new Hono();
+  app.use('*', apiContext());
+  app.get('/api/ping', (c) => {
+    const context = c.get('lowdefyContext');
+    return c.json({
+      mode: context.mode,
+      scrubbed: context.scrubSecrets(`token ${secret} end`),
+    });
+  });
+  return app;
+}
+
+test('apiContext sets mode to prod', async () => {
+  const res = await createApp().request('/api/ping');
+  expect(res.status).toEqual(200);
+  const body = await res.json();
+  expect(body.mode).toEqual('prod');
+});
+
+test('apiContext scrubSecrets redacts a planted secret', async () => {
+  const res = await createApp().request('/api/ping');
+  expect(res.status).toEqual(200);
+  const body = await res.json();
+  expect(body.scrubbed).toEqual('token [REDACTED] end');
+});

package/src/routes/apiPage.js

@@ -16,6 +16,7 @@
 
 import { getPageConfig } from '@lowdefy/api';
 
+import appMeta from '../../lib/build/appMeta.js';
 import getPathSegments from '../lib/getPathSegments.js';
 
 // Page config as JSON for client-side SPA navigation. The first page load is
@@ -31,7 +32,9 @@ async function apiPageHandler(c) {
     return c.json({ pageConfig: null }, 404);
   }
   context.logger.info({ event: 'api_page_view', pageId });
-  return c.json({ pageConfig });
+  // buildId lets a tab that loaded its bundle from an earlier deploy notice
+  // that this config comes from a newer build and reload (client/Page.jsx).
+  return c.json({ buildId: appMeta.buildId, pageConfig });
 }
 
 export default apiPageHandler;

package/src/routes/apiPage.test.mjs

@@ -0,0 +1,59 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { Hono } from 'hono';
+import { jest } from '@jest/globals';
+
+const mockGetPageConfig = jest.fn();
+jest.unstable_mockModule('@lowdefy/api', () => ({
+  getPageConfig: mockGetPageConfig,
+}));
+
+jest.unstable_mockModule('../../lib/build/appMeta.js', () => ({
+  default: { buildId: 'build-abc' },
+}));
+
+const { default: apiPageHandler } = await import('./apiPage.js');
+
+function createApp() {
+  const app = new Hono();
+  app.use('*', async (c, next) => {
+    c.set('lowdefyContext', {
+      logger: { debug: jest.fn(), info: jest.fn(), error: jest.fn() },
+    });
+    await next();
+  });
+  app.get('/api/page/*', apiPageHandler);
+  return app;
+}
+
+afterEach(() => {
+  mockGetPageConfig.mockReset();
+});
+
+test('apiPageHandler returns the pageConfig stamped with the build id', async () => {
+  mockGetPageConfig.mockResolvedValue({ id: 'invoices' });
+  const res = await createApp().request('/api/page/invoices');
+  expect(res.status).toEqual(200);
+  expect(await res.json()).toEqual({ buildId: 'build-abc', pageConfig: { id: 'invoices' } });
+});
+
+test('apiPageHandler returns 404 when the page is not found', async () => {
+  mockGetPageConfig.mockResolvedValue(null);
+  const res = await createApp().request('/api/page/missing');
+  expect(res.status).toEqual(404);
+  expect(await res.json()).toEqual({ pageConfig: null });
+});

package/src/routes/cronForward.js

@@ -20,7 +20,7 @@ import getPathSegments from '../lib/getPathSegments.js';
 
 // Triggered by Vercel Cron on the production deployment: an HTTP GET to
 // /api/cron-forward/<environment>/<endpointId>, registered by `lowdefy vercel-output` for the
-// schedules of every environment declared with a url in config.cron.environments. Vercel fires crons
+// schedules of every environment declared with a cron.secret in config.environments. Vercel fires crons
 // only on production, so production pings that environment's own /api/cron/<endpointId> (with the
 // environment's CRON_SECRET) and answers immediately. Same transport auth as cron (CRON_SECRET,
 // fails closed).

package/lib/server/apiWrapper.js

@@ -1,87 +0,0 @@
-/*
-  Copyright 2020-2026 Lowdefy, Inc
-
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
-*/
-
-import path from 'path';
-import { createApiContext, redactErrorResponse } from '@lowdefy/api';
-import { getSecretsFromEnv } from '@lowdefy/node-utils';
-import { v4 as uuid } from 'uuid';
-
-import agents from '../../build/plugins/agents.js';
-import appMeta from '../build/appMeta.js';
-import config from '../build/config.js';
-import i18nConfig from '../build/i18n.js';
-import connections from '../../build/plugins/connections.js';
-import createLogger from './log/createLogger.js';
-import fileCache from './fileCache.js';
-import getServerSession from './auth/getServerSession.js';
-import createHandleError from './log/createHandleError.js';
-import logRequest from './log/logRequest.js';
-import operators from '../../build/plugins/operators/server.js';
-import jsMap from '../../build/plugins/operators/serverJsMap.js';
-import getAuthOptions from './auth/getAuthOptions.js';
-import loggerConfig from '../build/logger.js';
-import setSentryUser from './sentry/setSentryUser.js';
-
-const secrets = getSecretsFromEnv();
-
-function apiWrapper(handler) {
-  return async function wrappedHandler(req, res) {
-    const context = {
-      // Important to give absolute path so Next can trace build files
-      rid: uuid(),
-      agents,
-      appMeta,
-      buildDirectory: path.join(process.cwd(), 'build'),
-      config,
-      connections,
-      fileCache,
-      headers: req?.headers,
-      i18n: i18nConfig,
-      jsMap,
-      handleError: async (err) => {
-        console.error(err);
-      },
-      logger: console,
-      operators,
-      req,
-      res,
-      secrets,
-    };
-    try {
-      context.logger = createLogger({ rid: context.rid });
-      context.handleError = createHandleError({ context });
-      context.authOptions = getAuthOptions(context);
-      if (!req.url.startsWith('/api/auth')) {
-        context.session = await getServerSession(context);
-        // Set Sentry user context for authenticated requests
-        setSentryUser({
-          user: context.session?.user,
-          sentryConfig: loggerConfig.sentry,
-        });
-      }
-      createApiContext(context);
-      logRequest({ context });
-      // Await here so that if handler throws it is caught.
-      const response = await handler({ context, req, res });
-      return response;
-    } catch (error) {
-      await context.handleError(error);
-      res.status(500).json(redactErrorResponse(context, error));
-    }
-  };
-}
-
-export default apiWrapper;